# CVEs published 2019-08-08

59 CVEs were published on August 8, 2019: 0 critical, 2 high. Days are UTC.

- [CVE-2019-14783](https://cve.now/CVE-2019-14783.md): On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. (no CVSS)
- [CVE-2016-10862](https://cve.now/CVE-2016-10862.md): Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. (no CVSS)
- [CVE-2018-20954](https://cve.now/CVE-2018-20954.md): The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys. (no CVSS)
- [CVE-2018-20955](https://cve.now/CVE-2018-20955.md): Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. (no CVSS)
- [CVE-2018-20956](https://cve.now/CVE-2018-20956.md): Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. (no CVSS)
- [CVE-2018-20957](https://cve.now/CVE-2018-20957.md): The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks. (no CVSS)
- [CVE-2018-20960](https://cve.now/CVE-2018-20960.md): Nespresso Prodigio devices lack Bluetooth connection security. (no CVSS)
- [CVE-2017-18484](https://cve.now/CVE-2017-18484.md): Cognitoys Dino devices allow XSS via the SSID. (no CVSS)
- [CVE-2017-18485](https://cve.now/CVE-2017-18485.md): Cognitoys Dino devices allow profiles\_add.html CSRF. (no CVSS)
- [CVE-2016-10863](https://cve.now/CVE-2016-10863.md): Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure. (no CVSS)
- [CVE-2015-9292](https://cve.now/CVE-2015-9292.md): 6kbbs 7.1 and 8.0 allows CSRF via portalchannel\_ajax.php (id or code parameter) or admin.php (fileids parameter). (no CVSS)
- [CVE-2019-14679](https://cve.now/CVE-2019-14679.md): core/views/arprice\_import\_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite\_import\_export CSRF. (no CVSS)
- [CVE-2019-14680](https://cve.now/CVE-2019-14680.md): The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/a (no CVSS)
- [CVE-2019-14681](https://cve.now/CVE-2019-14681.md): The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf\_settings&daf\_remove=true CSRF. (no CVSS)
- [CVE-2019-14682](https://cve.now/CVE-2019-14682.md): The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs\_admin\_page C (no CVSS)
- [CVE-2019-14683](https://cve.now/CVE-2019-14683.md): The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui\_delete\_attac (no CVSS)
- [CVE-2018-20962](https://cve.now/CVE-2018-20962.md): The Backpack\\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type. (no CVSS, backpack/crud)
- [CVE-2019-14773](https://cve.now/CVE-2019-14773.md): admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action (no CVSS)
- [CVE-2019-14774](https://cve.now/CVE-2019-14774.md): The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=w (no CVSS)
- [CVE-2019-14353](https://cve.now/CVE-2019-14353.md): On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. (no CVSS)
- [CVE-2019-12959](https://cve.now/CVE-2019-12959.md): Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in (no CVSS)
- [CVE-2019-12994](https://cve.now/CVE-2019-12994.md): Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a (no CVSS)
- [CVE-2019-14693](https://cve.now/CVE-2019-14693.md): Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. (CVSS 8.5)
- [CVE-2019-12397](https://cve.now/CVE-2019-12397.md): Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. (no CVSS, Apache Software Foundation Apache Ranger · org.apache.range…)
- [CVE-2019-5239](https://cve.now/CVE-2019-5239.md): Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have an information leak vulnerability. (no CVSS, Huawei PCManager)
- [CVE-2019-5238](https://cve.now/CVE-2019-5238.md): Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution vulnerability. (no CVSS, Huawei PCManager)
- [CVE-2019-5237](https://cve.now/CVE-2019-5237.md): Huawei PCManager with the versions before 9.0.1.66 (Oversea) and versions before 9.0.1.70 (China) have a code execution vulnerability. (no CVSS, Huawei PCManager)
- [CVE-2019-5301](https://cve.now/CVE-2019-5301.md): Huawei smart phones Honor V20 with the versions before 9.0.1.161(C00E161R2P2) have an information leak vulnerability. (no CVSS, Huawei Honor)
- [CVE-2019-5236](https://cve.now/CVE-2019-5236.md): Huawei smart phones Emily-L29C with versions of 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1.0.154(C635), 8.1.0.1 (no CVSS, Huawei Emily-L29C)
- [CVE-2019-11208](https://cve.now/CVE-2019-11208.md): TIBCO API Exchange Processes OAuth Incorrectly (CVSS 6.4, TIBCO Software TIBCO API Exchange Gateway)
- [CVE-2019-13176](https://cve.now/CVE-2019-13176.md): An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. (no CVSS)
- [CVE-2019-14335](https://cve.now/CVE-2019-14335.md): An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. (no CVSS)
- [CVE-2019-14772](https://cve.now/CVE-2019-14772.md): verdaccio before 3.12.0 allows XSS. (no CVSS, verdaccio)
- [CVE-2018-19855](https://cve.now/CVE-2018-19855.md): UiPath Orchestrator before 2018.3.4 allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features (no CVSS)
- [CVE-2016-10864](https://cve.now/CVE-2016-10864.md): NETGEAR EX7000 V1.0.0.42\_1.0.94 devices allow XSS via the SSID. (no CVSS)
- [CVE-2019-14255](https://cve.now/CVE-2019-14255.md): A Server Side Request Forgery (SSRF) vulnerability in go-camo up to version 1.1.4 allows a remote attacker to perform HTTP requests to inter (no CVSS)
- [CVE-2019-14221](https://cve.now/CVE-2019-14221.md): 1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation. (no CVSS)
- [CVE-2019-14754](https://cve.now/CVE-2019-14754.md): Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter. (no CVSS)
- [CVE-2019-13101](https://cve.now/CVE-2019-13101.md): An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. (no CVSS)
- [CVE-2019-1973](https://cve.now/CVE-2019-1973.md): Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability (CVSS 4.8, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1959](https://cve.now/CVE-2019-1959.md): Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities (CVSS 4.4, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1960](https://cve.now/CVE-2019-1960.md): Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities (CVSS 4.4, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1961](https://cve.now/CVE-2019-1961.md): Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability (CVSS 4.9, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1970](https://cve.now/CVE-2019-1970.md): Cisco Firepower Threat Defense Software File Policy Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2019-1971](https://cve.now/CVE-2019-1971.md): Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability (CVSS 8.1, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1972](https://cve.now/CVE-2019-1972.md): Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability (CVSS 6.7, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1953](https://cve.now/CVE-2019-1953.md): Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability (CVSS 6.5, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1954](https://cve.now/CVE-2019-1954.md): Cisco Webex Meetings Server Open Redirection Vulnerability (CVSS 4.3, Cisco WebEx Meetings Server)
- [CVE-2019-1955](https://cve.now/CVE-2019-1955.md): Cisco Email Security Appliance Header Injection Vulnerability (CVSS 5.3, Cisco Email Security Appliance)
- [CVE-2019-1956](https://cve.now/CVE-2019-1956.md): Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco SPA112 2-Port Phone Adapter)
- [CVE-2019-1957](https://cve.now/CVE-2019-1957.md): Cisco IoT Field Network Director TLS Renegotiation Denial of Service Vulnerability (CVSS 5.3, Cisco IoT Field Network Director)
- [CVE-2019-1958](https://cve.now/CVE-2019-1958.md): Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability (CVSS 5.4, Cisco HyperFlex HX-Series)
- [CVE-2019-1949](https://cve.now/CVE-2019-1949.md): Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2019-1951](https://cve.now/CVE-2019-1951.md): Cisco SD-WAN Solution Packet Filtering Bypass Vulnerability (CVSS 5.8, Cisco SD-WAN Solution)
- [CVE-2019-1952](https://cve.now/CVE-2019-1952.md): Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability (CVSS 6.7, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-1946](https://cve.now/CVE-2019-1946.md): Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication Bypass Vulnerability (CVSS 6.5, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2019-14769](https://cve.now/CVE-2019-14769.md): Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 doesn't sufficiently filter output when displaying certain block labels created b (no CVSS)
- [CVE-2019-14770](https://cve.now/CVE-2019-14770.md): In Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3, some menu links within the administration bar may be crafted to execute JavaS (no CVSS)
- [CVE-2019-14771](https://cve.now/CVE-2019-14771.md): Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interfac (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2019-08-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.